Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.


It seems like you don't want to install Google Play Services on your device. My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all), but because you don't want to run proprietary software.

There's a very small number of people who find this to be very important, and my experience has been that the strategy is to loudly complain whenever anything depends on play services. Just tactically speaking, I don't think this is going to work in the end, in the same sense that simply refusing to have a mobile phone won't work anymore -- slowly, the circumstances around this technology will make it impossible to refuse.

What I don't understand is why nobody just writes an API-compatible open source implementation of play services. Even if it only supported GCM and nothing else, that'd unlock an enormous swath of apps, and would only require writing a basic implementation of the GCM network protocol.

I'd love to know more if I'm misunderstanding the challenges around doing that. Right now it's part of the reason that I don't pay much attention to that crowd -- everyone seems very willing to complain, but nobody seems willing to do what seems like pretty straightforward work to solve their own problem.


There you go:

https://github.com/microg/android_packages_apps_GmsCore

An open-source replacement of Google services. You can use Signal with this.


I wrote a little guide on how to set it up: http://o9i.de/2015/10/23/howto-gmscore.html

Has been working reasonably well for ~10 days now. Note that I'm on Android 4.2, so I might have missed something with regard to newer Android versions.


just debunking the bogus "you are a nerd that has a pet peeve against google services". this affect lots of users overseas or in poorer markets than san francisco.

amazon phones don't ship with google service. cheap samsung models (most dual sim ones) sold overseas don't ship with it either. the cheap chinese phones don't have any google service. ...and those are only the ones i saw. i'm sure india/africa/europe have even more cases.


Close, it's less about propriety software and more about centralisation of services. I definitely tend towards open-source but it's not a dealbreaker, I just don't want to live in a world where my life is completely tied to Google. As good as a lot of their apps are, I hate the idea of the "ecosystem" that these companies are building.

I just want a messaging app that messages and doesn't imply a bunch of other services from another company. I'm aware that's easier said than done, I just hope the end-game of instant messaging isn't "Apple or Google?". To continue your comparison with mobile phones, you can have a SIM from any network and still communicate with people.

I'm going to try GcmCore that's been posted in this thread, it sounds interesting.

To be completely honest, it's not a die-hard opinion and will no doubt change a bit in the future. Technology is progressing and changing so fast, I don't want to go with the flow without questioning directions it's going in.

I know this is a niche choice, I don't expect anybody to cater to it specifically, I'm just happier putting together smaller apps that do what I want instead of installing an entire ecosystem. Hope that all makes sense.

EDIT: Just realised after pressing send that the difference in my mobile phone analogy is the customer obviously pays to use it, maybe I'd be happier with paying for the network, I don't know. Doubt there's a market for that though!


I'm not an Android developer so I hope my mental picture of what GCM does isn't off.

> My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all),

Using GCM still means that Google could suddenly stop to relay the messages for some users, right? (Say, those who seem to be using a non-official reimplementation of GCM...). Then the service would suddenly stop working for these users. So I'd still rather be able to avoid relying on the GCM backend at all, if that's possible.

> What I don't understand is why nobody just writes an API-compatible open source implementation of play services

Couldn't the Play Services API change without warning? It is sensibly designed so another implementation wouldn't be too hackish?

People shouldn't have to reimplement such things by mimicking Google's API. In principle, there should be a documented and stable standard, not hacky reimplementations.

I agree, though, that probably the way to go would be to first build a different messaging system like this (maybe using XMPP as a backend?).


It's mostly because there aren't any real alternatives. Building a world wide push messaging network is really hard (you have to deal with carriers a lot and convince them not to close your long running connections after 5 minutes). That said, the servers support websocket connections as well. I don't know the current state of client support. Also, a Chrome/Chromium extension is in the works.


Making push notifications work well is hard, so it's better to just use what's available. There are alternatives, but the alternatives aren't free at all. See: https://pushy.me/


Just send heartbeats and reconnect if needed?

Only real problems I see are hosting costs and preventing misuse, plus some minor coding work.


See here for a version that uses websockets instead of Google services. It's usable on Blackberry OS 10 so should be usable on other non-google devices.

http://forums.crackberry.com/android-apps-amazon-store-apk-f...


What does it send via googleplay other than "please connect to the server now"?


it does require to have the google play services installed in the first place. so for those who i.e. run cyanogenmod without the google play services installed, it's unfortunately not possible to use Signal/TextSecure.


microg's GmsCore (an unprivileged open source reimplementation of Google Play Services) can do Google Cloud Messaging and should work for Signal.


This looks interesting.

Thanks!


It sends messages through Google's messaging framework. Of course the messages are end to end encrypted, so there's no security risk. It's just really hard to set up a global push messaging framework unless you have the clout of, say, Google.


I believe it doesn't actually send the message content through GCM anymore, but just notifies the client that a new message is available and tells it to connect to Open Whisper Systems' server for the content.


Does it actually use Google Play Services during normal operation or does it just depend on the Play Store for installation?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: